Sign in
Menu
Sign up
Docs
Adopt in an existing estateMigration kit

Version compatibility

For an engineer checking whether a pinned terraform-aws-modules version can move to compliance.tf as it is. Each compliance.tf module is built against specific major versions of its upstream module (that build is called an adapter); the tables list the upstream versions each adapter supports.

If your version is inside the range, change the source and keep your version constraint. If it is older, upgrade the upstream module first, then migrate. The Terraform and OpenTofu versions each module needs are on Compatibility with terraform-aws-modules.

Storage

ModuleSupported versionsNotes
S3 Bucket>= 5.0.0Direct swap from v5.x
EFS>= 2.0.0Direct swap from v2.x
FSx~> 1.3Pinned to 1.3.x range. Covers Lustre, OpenZFS, ONTAP, and Windows submodules

Compute and containers

ModuleSupported versionsNotes
Auto Scaling>= 9.0.0Direct swap from v9.x
EC2 Instance>= 6.0.0Direct swap from v6.x
Lambda>= 8.0.0Direct swap from v8.x
ECS>= 6.0.0Direct swap from v6.x
EKS>= 21.0.0Direct swap from v21.x
ECR>= 2.0.0Direct swap from v2.x

Networking and edge

ModuleSupported versionsNotes
ALB>= 10.0.0, < 11.0.0v10.x only
CloudFront>= 6.0.0, < 7.0.0v6.x only
ELB (Classic)>= 4.0.0, < 5.0.0v4.x only
Network Firewall>= 1.0.0Direct swap from v1.x
VPC>= 6.0.0Direct swap from v6.x
VPN Gateway>= 4.0.0, < 5.0.0v4.x only
WAFv2>= 2.0.0, < 3.0.0v2.x only

Databases, caching and analytics

ModuleSupported versionsNotes
DMS>= 2.0.0Direct swap from v2.x
DynamoDB Table>= 5.0.0Direct swap from v5.x
ElastiCache>= 1.0.0, < 2.0.0v1.x only
OpenSearch>= 2.0.0, < 3.0.0v2.x only
RDS>= 7.0.0Direct swap from v7.x
RDS Aurora>= 10.0.0, < 11.0.0v10.x only
Redshift>= 7.0.0, < 8.0.0v7.x only
EMR>= 3.0.0Direct swap from v3.x

Security, keys and configuration

ModuleSupported versionsNotes
ACM>= 6.0.0, < 7.0.0v6.x only
KMS>= 4.0.0Direct swap from v4.x
Secrets Manager>= 2.0.0Direct swap from v2.x
SSM Parameter>= 2.0.0Direct swap from v2.x

Messaging and streaming

ModuleSupported versionsNotes
MSK Kafka Cluster>= 3.0.0Direct swap from v3.x
SNS>= 7.0.0Direct swap from v7.x
SQS>= 5.0.0Direct swap from v5.x

API and application integration

ModuleSupported versionsNotes
API Gateway V2>= 6.0.0Direct swap from v6.x
AppSync>= 3.0.0Direct swap from v3.x
Step Functions>= 5.0.0Direct swap from v5.x

Observability

ModuleSupported versionsNotes
CloudWatch>= 5.0.0Direct swap from v5.x

If you pin an older version

If your upstream module version is below the minimum supported version, upgrade the upstream module first (staying on terraform-aws-modules/...) and verify the upgrade is clean. Then change the source to compliance.tf.

Upgrading the upstream module and migrating to compliance.tf in a single step is not recommended. Separate the two changes so you can attribute any plan diff to the right cause.

If you pin a newer version

Adapters with open-ended constraints (e.g., >= 5.0.0) support all future minor and patch releases of that major version. Adapters with upper bounds (e.g., >= 10.0.0, < 11.0.0) are pinned to a single major version. When a new major version of the upstream module is released, a new adapter is added to compliance.tf.

On this page

Ask AI about this

Help improve this page